template risk assessment process word documents pdf vt security edu wanew adapted criteria illustrates criterion quantification